agenttesla | 903510c99c89320dccdbf6302184d2c0aefc58c4fc95e703ac0e65bdd86eea02

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SCANDOC109.js
Size 387KB
Sample261009-sd4bmsy17n
SHA256 903510c99c89320dccdbf6302184d2c0aefc58c4fc95e703ac0e65bdd86eea02
MD5 b6247d8d013377d71088cb0aaf4b822a
SHA1 3bb256896c486a6841c899aee2425970b3648a4f
SHA512 e982c145bb1eb0e5d03d4136a68dca2da9f6794a06379164c9b917d623c286859a6d5216c01a94464392dec9fe9ced9bb13b1591e6af3c251fd3224d122e5770
SSDEEP 12288:hSEQMramC5DzCLBjnrzEjA7s5RgMcBeaNHTW:kEQTmCFU5nrzreRgptW
TLSH
T1568423F93AC32ADA23F0D640C94665AC718A6F7307AA7354CBE8D4850B4DF57CB57888
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol
smtp
Host
smtp.hostinger.com
Port
587
Username
[email protected]
Password
Racheal123@@
Email to
[email protected]

Signatures

Family: AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1360	1820	powershell.exe	89

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1360	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1360 set thread context of 6064	1360	powershell.exe	94

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1360	powershell.exe
1360	powershell.exe
6064	InstallUtil.exe
6064	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	6064	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 952	1360	powershell.exe	92
PID 952 wrote to memory of 3248	952	csc.exe	93
PID 1360 wrote to memory of 6064	1360	powershell.exe	94
PID 1360 wrote to memory of 6064	1360	powershell.exe	94
PID 1360 wrote to memory of 6064	1360	powershell.exe	94
PID 1360 wrote to memory of 6064	1360	powershell.exe	94
PID 1360 wrote to memory of 6064	1360	powershell.exe	94
PID 1360 wrote to memory of 6064	1360	powershell.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SCANDOC109.js
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:4628

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -NoPr -NonI -WindowStyle Hidden -C "[scriptblock]::Create([IO.File]::ReadAllText('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d7cc1a13.ps1')).Invoke()"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\55i45dah\55i45dah.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBA23.tmp" "c:\Users\Admin\AppData\Local\Temp\55i45dah\CSCF1E36E3B29F4012A9A631494BBF9E61.TMP"
    3⤵
    PID:3248
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

55i45dah.dll

Path C:\Users\Admin\AppData\Local\Temp\55i45dah\55i45dah.dll
Size 10KB
SHA256 190b4b03a00697672b326e8ac195c640afbd1e258231df33fed494d7f837d8b9
MD5 b95972681e27d2a1eb3f8a4e71940331
SHA1 e3e0b2008702f1249c94544a74214a4704d738b2
SHA512 8cbe7ca587a0b3c307e8221027f5b997d5818bc00888b43317c7871585f2da9cbab3a513247e614883b0cc37b28fbdb99926f61a341a086b6d9b767e0b9a8717
SSDEEP 192:6jxjB8AVxwPS+qKUGKdC5Scvpq8QMtIjcxfkUawzZ7Qt3N:6Fj+AVxT09K0vTQfIhDbst9
TLSH
T1CC22F62757ED5663E0EF0739A5630296C531F932178AE31B08D5687C3D107F03B6ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESBA23.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESBA23.tmp
Size 1KB
SHA256 f320e86a4144a304ca71679a9ea144b752c283632bba624aae36a74ee852b160
MD5 86795d37588c53af61d077c7270c01fc
SHA1 e3b0935b7f06112cb7ae4a4c3dd7a21b4811f5c4
SHA512 83c2dfab243e0a6b8ed19299e537733e70b4dca7dff82b77f616abfe0d9d4a50fe1c3365a65eced1acc7b101cfd16c42c86ed60bef76dc462ae9acff1f2cd5a1
TLSH
T11B21AF0583E8471FF0734731AAF6132BD634FE64EFB1975A4580022D2C51554EEA0E76
MD5 SHA1 SHA512 TLSH

Submit Download

d7cc1a13.ps1

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\d7cc1a13.ps1
Size 163KB
SHA256 320bc315bde2835e948961837218bc562107d7ec8b68d58a3703cd4d82bf4bf2
MD5 1a1f3972766d7e133c46582cc5d02026
SHA1 11d6ad78090b6f98ff65a0648e4c529d00aba836
SHA512 494f3fbd67f8c8ec597830ec695edb440963639e80e2bd9f6b5f60e928ea2eecb5370b5999169db82538d8bee90d3f1dca2772e31239a29a7cd8f3f3d07caaf0
SSDEEP 3072:8qZ7QJ4gISxHn5OBPjwliyE8Bjy9zFfjhwtU2VYT3GaUJ8M:8NJFIw5OdCzBjyf7hwtU2FKM
TLSH
T1B0F30231193C01ADC08D690A61E2370DFFFA8937A97DA9603CD90A9A3E9D745E137E53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55i45dah.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\55i45dah\55i45dah.0.cs
Size 9KB
SHA256 b24d123c2f6d4fd707e5201f363a0f056c52cdb65304c8a58d08cd31e6c9d0f9
MD5 465be63236ace149b92045a678967dde
SHA1 8bce39ae59e827287e88cceac87a32bedfdaeaf0
SHA512 451a986665cdd5f802acc4c2b53497f783d349bbc788806fb2a95b4b7d5cc0ef1e4308fb919eea97cd4917989ffb11b0735b18ecebc8ab9b1d7f1ab69790af12
SSDEEP 192:ixeVc9hgUxfAHM9iiVGeeiJkLhz/gnETwkt:UeV+eUxEMJpkt
TLSH
T1AB128499092C45AA40FE6909D9C5112EFB4375330AF86E3074CE52651FAE2DEF237F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55i45dah.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\55i45dah\55i45dah.cmdline
Size 369B
SHA256 e1962bfc1434f2302896e47fa4bca1990ed650a21c6efe0738c44d22ab7a9709
MD5 e7357b7ff3a7bf0744557f1c49775fc5
SHA1 39d3fc0f4dc208f0af5c605ec887e49983852748
SHA512 0f5c796c34d0878e81210782ec6641245bbe10e8a4e78799e4b1785a2d0982b0dfb469f51fe136922cf9b5597b162e2d39b300410e17de5148b9de31dae286ce
TLSH
T177E0C07A9246C3FD27DD10072169ECBCC27307833940BF8454404D8DE09780027D1751
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF1E36E3B29F4012A9A631494BBF9E61.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\55i45dah\CSCF1E36E3B29F4012A9A631494BBF9E61.TMP
Size 652B
SHA256 e1a609bcefdcabef4a07d7b40511872e5ad59f8a6f6133e8357654fac14e2cc1
MD5 fb661cd8b86b9d8359a7769d2990e951
SHA1 ef01f526b0385e76c8271f346e807a2b75f9dd1f
SHA512 e5704bbf862fe222883a274c773a40ed5f1ec86a5ed870b0fa12eba36b39481cd343f901a0528074b7d7105295fe615a09bd887c3292479357c8f8c5a84edb5d
TLSH
T1EBF0540963F8020EF0F34B30BEF543A3D569BC64DE3253ED148103192C645148561F79
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1360-8-0x0000000006350000-0x00000000063B6000-memory.dmp

Download

memory/1360-3-0x0000000074C80000-0x000000007543C000-memory.dmp

Download

memory/1360-11-0x0000000006570000-0x00000000068CB000-memory.dmp

Download

memory/1360-12-0x00000000069B0000-0x00000000069CE000-memory.dmp

Download

memory/1360-13-0x0000000006A00000-0x0000000006A4C000-memory.dmp

Download

memory/1360-7-0x00000000062E0000-0x0000000006346000-memory.dmp

Download

memory/1360-15-0x0000000007FF0000-0x000000000866C000-memory.dmp

Download

memory/1360-16-0x0000000006FA0000-0x0000000006FBA000-memory.dmp

Download

memory/1360-6-0x0000000005AD0000-0x0000000005AF2000-memory.dmp

Download

memory/1360-5-0x0000000074C80000-0x000000007543C000-memory.dmp

Download

memory/1360-4-0x0000000005C90000-0x00000000062DA000-memory.dmp

Download

memory/1360-1-0x0000000074C92000-0x0000000074C93000-memory.dmp

Download

memory/1360-2-0x00000000054D0000-0x0000000005506000-memory.dmp

Download

memory/1360-29-0x0000000007980000-0x000000000798A000-memory.dmp

Download

memory/1360-35-0x0000000074C80000-0x000000007543C000-memory.dmp

Download

memory/1360-32-0x0000000007C10000-0x0000000007C32000-memory.dmp

Download

memory/1360-31-0x0000000007CB0000-0x0000000007D46000-memory.dmp

Download

memory/1360-33-0x0000000008C30000-0x00000000091EA000-memory.dmp

Download

memory/6064-30-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/6064-36-0x00000000062A0000-0x0000000006332000-memory.dmp

Download

memory/6064-37-0x0000000006340000-0x0000000006390000-memory.dmp

Download

memory/6064-38-0x0000000006290000-0x000000000629A000-memory.dmp

Download